Overview

overview

8

Static

static

3

PI_20052024.exe

windows7-x64

8

PI_20052024.exe

windows10-2004-x64

8

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PI_20052024.lzh

  • Size

    444KB

  • Sample

    240522-b7x82sgd96

  • MD5

    f87c9a83d7c519fa7fcf68169e6d7b81

  • SHA1

    45b11f33526dbb302371a1ce5e789232e5620568

  • SHA256

    2c8fd3ab3038ddb79842d5807e0f6120ad290855c41abc8783a1665a309b8549

  • SHA512

    1c6677cb3bcd771b7f10b22ecaed7a95c51129f77ea9b45e5f4ea23fa642393c5483f24238eb847cd0842e7e5b1c2c8d40f96f030702ed023064f40b49758b18

  • SSDEEP

    12288:koTdhS8+oSXIbEmbmpHIP5ESbhbnx3ttSxn9OK:koJh4oGIbEmahIuuxPt40K

Score
8/10
executionpersistence

Malware Config

Targets

    • Target

      PI_20052024.exe

    • Size

      568KB

    • MD5

      e4370a31c71c37bde2e16022fa0459c2

    • SHA1

      10890db50f2aac0931eec94f45e012944efed869

    • SHA256

      49ffcfe176de375dbbb2e4d50043d80fa254ca6b4ffc6d18d9501b6d8841a436

    • SHA512

      1454935b456d4fc26b978fb4a38ec34ba673ba27ccc23c9d73328441cbdfd78baade7173eefbd2d51ffa42cd8e20697521d0128f4f08b1800293c613ac60d5af

    • SSDEEP

      12288:mH7MMIqb9BaBUbdD4aPHb2XR+MAghog0RdBBplW8Lmy:+7a69BWUhD3Ha+MPCXtlW8Lmy

    Score
    8/10
    executionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1c8b2b40c642e8b5a5b3ff102796fb37

    • SHA1

      3245f55afac50f775eb53fd6d14abb7fe523393d

    • SHA256

      8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

    • SHA512

      4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

    • SSDEEP

      96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      09c2e27c626d6f33018b8a34d3d98cb6

    • SHA1

      8d6bf50218c8f201f06ecf98ca73b74752a2e453

    • SHA256

      114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1

    • SHA512

      883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954

    • SSDEEP

      96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks